Dataset Attack: 
In our final and most powerful attack, we make use of all adversary capabilities.
The DP-SGD analysis yields a guarantee which holds for all pairs of datasets with a Hamming distance of 1, even if these datasets are pathological worst-case datasets.
Thus, in this setting, we allow the adversary to construct such a pathalogical dataset.
Evaluating this setting is what allows us to demonstrate that the DP-SGD analysis is tight. The tightness of the DP-SGD privay bounds in the worst case can also be inferred from the theoretical analysis [1]}, [2]}, however, the main purpose of this evaluation is to show that our attack can be tight when the adversary is the most powerful. If we could not reach the provable upper bound, then we would have no hope that our results would be tight in the other settings. Moreover, we crafted a specific attack to achieve the highest possible privacy leakage.
